4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d

Analysis

max time kernel
34s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
Size

24KB
MD5

2b200ec64e40e60e9f6e54e745907285
SHA1

c8d33050958474f21748175d63fc1d4304eaea77
SHA256

4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d
SHA512

ba2bc0fa635b8cda426a9e2c7c79a9c8a1c6d3b1f3e4bb7dba46e22f5b384e489eba96bc3e29c9492622a9b68c8de0b5292b9e995f724a932295ed9190213e9c
SSDEEP

192:urlQjc8ORjQkX33ON6koWXU8i6w4Vgogb1Y2fmO1nD3eWcwQ:iOejk6kRU8i6w4V6Jf/1DuWc

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 64 IoCs

evasion

pid	Process
404	taskkill.exe
4848	Process not Found
4108	Process not Found
2388	Process not Found
4892	Process not Found
4912	taskkill.exe
4912	taskkill.exe
856	taskkill.exe
2392	taskkill.exe
1252	Process not Found
1644	Process not Found
4492	Process not Found
4744	Process not Found
3684	Process not Found
464	Process not Found
4876	taskkill.exe
4544	Process not Found
4056	Process not Found
2896	Process not Found
4804	taskkill.exe
2936	Process not Found
3964	taskkill.exe
3780	Process not Found
2784	Process not Found
2236	Process not Found
4036	Process not Found
1804	Process not Found
4028	taskkill.exe
1228	taskkill.exe
2640	taskkill.exe
3644	taskkill.exe
4492	Process not Found
2036	Process not Found
3232	Process not Found
2384	Process not Found
2716	Process not Found
4348	Process not Found
4804	Process not Found
4568	taskkill.exe
1384	taskkill.exe
4520	taskkill.exe
4440	taskkill.exe
4180	Process not Found
2008	Process not Found
2360	taskkill.exe
532	Process not Found
4448	Process not Found
4932	Process not Found
3268	Process not Found
444	Process not Found
3432	Process not Found
2536	taskkill.exe
2040	Process not Found
4916	Process not Found
4544	taskkill.exe
2728	Process not Found
2640	Process not Found
3416	Process not Found
3388	Process not Found
4788	Process not Found
3640	Process not Found
1816	Process not Found
2652	Process not Found
1216	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3468	taskkill.exe
Token: SeDebugPrivilege	3644	taskkill.exe
Token: SeDebugPrivilege	4528	taskkill.exe
Token: SeDebugPrivilege	4996	taskkill.exe
Token: SeDebugPrivilege	1016	taskkill.exe
Token: SeDebugPrivilege	3308	taskkill.exe
Token: SeDebugPrivilege	404	taskkill.exe
Token: SeDebugPrivilege	4076	taskkill.exe
Token: SeDebugPrivilege	4092	taskkill.exe
Token: SeDebugPrivilege	1176	taskkill.exe
Token: SeDebugPrivilege	4800	taskkill.exe
Token: SeDebugPrivilege	3388	taskkill.exe
Token: SeDebugPrivilege	2556	taskkill.exe
Token: SeDebugPrivilege	3640	taskkill.exe
Token: SeDebugPrivilege	2244	taskkill.exe
Token: SeDebugPrivilege	3432	taskkill.exe
Token: SeDebugPrivilege	3484	taskkill.exe
Token: SeDebugPrivilege	4028	taskkill.exe
Token: SeDebugPrivilege	1504	taskkill.exe
Token: SeDebugPrivilege	3268	taskkill.exe
Token: SeDebugPrivilege	4036	taskkill.exe
Token: SeDebugPrivilege	4556	taskkill.exe
Token: SeDebugPrivilege	3676	taskkill.exe
Token: SeDebugPrivilege	3160	taskkill.exe
Token: SeDebugPrivilege	2376	taskkill.exe
Token: SeDebugPrivilege	4804	taskkill.exe
Token: SeDebugPrivilege	1344	taskkill.exe
Token: SeDebugPrivilege	4568	taskkill.exe
Token: SeDebugPrivilege	3388	taskkill.exe
Token: SeDebugPrivilege	2208	taskkill.exe
Token: SeDebugPrivilege	3640	taskkill.exe
Token: SeDebugPrivilege	2436	taskkill.exe
Token: SeDebugPrivilege	2604	taskkill.exe
Token: SeDebugPrivilege	400	taskkill.exe
Token: SeDebugPrivilege	4512	taskkill.exe
Token: SeDebugPrivilege	2156	taskkill.exe
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeDebugPrivilege	5080	taskkill.exe
Token: SeDebugPrivilege	3440	taskkill.exe
Token: SeDebugPrivilege	4988	taskkill.exe
Token: SeDebugPrivilege	4992	taskkill.exe
Token: SeDebugPrivilege	4364	taskkill.exe
Token: SeDebugPrivilege	4300	taskkill.exe
Token: SeDebugPrivilege	4372	taskkill.exe
Token: SeDebugPrivilege	2792	taskkill.exe
Token: SeDebugPrivilege	3960	taskkill.exe
Token: SeDebugPrivilege	4832	taskkill.exe
Token: SeDebugPrivilege	1544	taskkill.exe
Token: SeDebugPrivilege	1224	taskkill.exe
Token: SeDebugPrivilege	4536	taskkill.exe
Token: SeDebugPrivilege	1444	taskkill.exe
Token: SeDebugPrivilege	4844	taskkill.exe
Token: SeDebugPrivilege	4912	taskkill.exe
Token: SeDebugPrivilege	2372	taskkill.exe
Token: SeDebugPrivilege	3256	taskkill.exe
Token: SeDebugPrivilege	4244	taskkill.exe
Token: SeDebugPrivilege	4180	taskkill.exe
Token: SeDebugPrivilege	2972	taskkill.exe
Token: SeDebugPrivilege	4692	taskkill.exe
Token: SeDebugPrivilege	1228	taskkill.exe
Token: SeDebugPrivilege	2556	taskkill.exe
Token: SeDebugPrivilege	3640	taskkill.exe
Token: SeDebugPrivilege	4116	taskkill.exe
Token: SeDebugPrivilege	2652	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 4088	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	85
PID 2204 wrote to memory of 4088	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	85
PID 2204 wrote to memory of 4088	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	85
PID 4088 wrote to memory of 3468	4088	cmd.exe	88
PID 4088 wrote to memory of 3468	4088	cmd.exe	88
PID 4088 wrote to memory of 3468	4088	cmd.exe	88
PID 2204 wrote to memory of 4360	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	89
PID 2204 wrote to memory of 4360	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	89
PID 2204 wrote to memory of 4360	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	89
PID 4360 wrote to memory of 3644	4360	cmd.exe	91
PID 4360 wrote to memory of 3644	4360	cmd.exe	91
PID 4360 wrote to memory of 3644	4360	cmd.exe	91
PID 2204 wrote to memory of 828	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	93
PID 2204 wrote to memory of 828	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	93
PID 2204 wrote to memory of 828	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	93
PID 828 wrote to memory of 4528	828	cmd.exe	145
PID 828 wrote to memory of 4528	828	cmd.exe	145
PID 828 wrote to memory of 4528	828	cmd.exe	145
PID 2204 wrote to memory of 4064	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	96
PID 2204 wrote to memory of 4064	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	96
PID 2204 wrote to memory of 4064	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	96
PID 4064 wrote to memory of 4996	4064	cmd.exe	150
PID 4064 wrote to memory of 4996	4064	cmd.exe	150
PID 4064 wrote to memory of 4996	4064	cmd.exe	150
PID 2204 wrote to memory of 1772	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	99
PID 2204 wrote to memory of 1772	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	99
PID 2204 wrote to memory of 1772	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	99
PID 1772 wrote to memory of 1016	1772	cmd.exe	101
PID 1772 wrote to memory of 1016	1772	cmd.exe	101
PID 1772 wrote to memory of 1016	1772	cmd.exe	101
PID 2204 wrote to memory of 4928	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	157
PID 2204 wrote to memory of 4928	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	157
PID 2204 wrote to memory of 4928	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	157
PID 4928 wrote to memory of 3308	4928	cmd.exe	104
PID 4928 wrote to memory of 3308	4928	cmd.exe	104
PID 4928 wrote to memory of 3308	4928	cmd.exe	104
PID 2204 wrote to memory of 3780	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	105
PID 2204 wrote to memory of 3780	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	105
PID 2204 wrote to memory of 3780	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	105
PID 3780 wrote to memory of 404	3780	cmd.exe	107
PID 3780 wrote to memory of 404	3780	cmd.exe	107
PID 3780 wrote to memory of 404	3780	cmd.exe	107
PID 2204 wrote to memory of 1560	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	108
PID 2204 wrote to memory of 1560	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	108
PID 2204 wrote to memory of 1560	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	108
PID 1560 wrote to memory of 4076	1560	cmd.exe	110
PID 1560 wrote to memory of 4076	1560	cmd.exe	110
PID 1560 wrote to memory of 4076	1560	cmd.exe	110
PID 2204 wrote to memory of 4692	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	111
PID 2204 wrote to memory of 4692	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	111
PID 2204 wrote to memory of 4692	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	111
PID 4692 wrote to memory of 4092	4692	cmd.exe	113
PID 4692 wrote to memory of 4092	4692	cmd.exe	113
PID 4692 wrote to memory of 4092	4692	cmd.exe	113
PID 2204 wrote to memory of 3584	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	114
PID 2204 wrote to memory of 3584	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	114
PID 2204 wrote to memory of 3584	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	114
PID 3584 wrote to memory of 1176	3584	cmd.exe	116
PID 3584 wrote to memory of 1176	3584	cmd.exe	116
PID 3584 wrote to memory of 1176	3584	cmd.exe	116
PID 2204 wrote to memory of 1064	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	117
PID 2204 wrote to memory of 1064	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	117
PID 2204 wrote to memory of 1064	2204	4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe	117
PID 1064 wrote to memory of 4800	1064	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe
"C:\Users\Admin\AppData\Local\Temp\4f9db0a6ce52f837cd0171054abade751db845445b1cb047e945e01f7e7c197d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1176
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3420
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2000
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4016
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2988
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3892
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2936
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4464
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:828
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4300
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4376
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4844
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4076
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3208
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4372
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:400
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    PID:4876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4220
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4464
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3884
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3780
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2376
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2036
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4892
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2336
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3892
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2272
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4980
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4376
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4360
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:5112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3004
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1360
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:5008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:5040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:5108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:8
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    PID:4568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3812
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3132
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4992
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4692
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3424
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4248
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5080
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3308
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    PID:4912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4880
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:5088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1652
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5108
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:5100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2344
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4064
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:5088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4600
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4616
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:736
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    PID:3964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1176
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2372
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    PID:1384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4060
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3940
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1268
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:5008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3988
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3740
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:372
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    PID:2536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3928
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2344
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2756
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3884
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2468
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3208
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:372
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:8
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4244
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4820
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3144
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    PID:2360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1552
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:5076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3716
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:5112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1940
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:220
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4668
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4832
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3076
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3248
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:212
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4248
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3392
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2376
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4056
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:404
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1360
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:5092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3540
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5008
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4668
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3624
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    PID:4520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2372
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    PID:4440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    PID:4544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4892
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4592
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    PID:856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4948
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:928
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3808
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4508
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    PID:2640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5096
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3132
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:5104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2468
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:928
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:864
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3624
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1260
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    PID:2392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2468
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:5000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4144
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1128
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4028
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2420
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2104
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3232
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4108
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1920
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4464
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4420
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2272
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3248
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3160
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3936
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4904
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4500
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    - Kills process with taskkill
    PID:3644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5080
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1920
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4340
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4444
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4832
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:2036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2360
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4108
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4744
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4060
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:5104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:5040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4144
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2372
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1268
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:2728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:5108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4076
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4344
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:3928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:3332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:1840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4664
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:1640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im cg_210.exe
  2⤵
  PID:4856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cg_210.exe
    3⤵
    PID:4824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:1544

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads